Using logstash 2.4
(I have my reasons) on Ubuntu 16.04
root@logbox:/etc/logstash/conf.d# ls -al
total 16
drwxrwxr-x 2 root root 4096 Nov 2 19:53 .
drwxrwxr-x 3 root root 4096 Nov 2 15:46 ..
-rwxrwxrwx 1 root root 277 Nov 2 19:52 01_01_input.conf
-rwxrwxrwx 1 root root 604 Nov 2 19:48 03_02_output_pa_http.conf
root@logbox:/etc/logstash/conf.d# cat *.conf
input {
stdin {}
file {
path => "/usr/share/logstash/files/production_input.txt"
start_position => "beginning"
# codec => plain { charset => "ISO-8859-1" }
codec => json
# add_field => [ 'redis_db', '10' ]
}
}
output {
stdout {}
}
root@logbox:/etc/logstash/conf.d# ls -al /usr/share/logstash/files/production_input.txt
-rwxrwxrwx 1 root root 11910 Nov 2 16:09 /usr/share/logstash/files/production_input.txt
However...
vagrant@logbox:/etc/logstash/conf.d$ sudo tail -f /var/log/logstash/logstash*
Sending logstash logs to /var/log/logstash/logstash.log.
==> /var/log/logstash/logstash.log <==
{:timestamp=>"2018-11-02T19:59:52.947000+0000", :message=>"Pipeline main started"}
==> /var/log/logstash/logstash.stdout <==
{:timestamp=>"2018-11-02T19:59:52.947000+0000", :message=>"Pipeline main started"}
The file is not printed in stdout
...I have tried both codecs (json
and plain
)
edit: actually it might be the case the file has been read only once; does this have to do with sincedb
?
how do I force logstash to read it again? isn't start_position => beginning
enough?